immutablelog.com

What It Is

ImmutableLog positions itself as an “Audit Evidence Layer,” rather than an observability, analytics, or public blockchain product. It uses a private permissioned ledger, append-only architecture, hash chains, and Merkle proofs to turn critical system events into independently verifiable audit evidence. Its core value is not answering “what is happening in the system right now,” but rather “what exactly happened in the past, and can we prove the records were not tampered with?”

Core Capabilities and Protection Model

The product emphasizes that once events are written via API, they go through stages such as validation, distribution, consensus, chained hashing, append-only storage, and future verification. Each event payload is hashed with SHA-256, and inclusion proofs can be retrieved through the /proof endpoint. It primarily protects against the risk that traditional logs may be modified, rotated, deleted, or unable to prove integrity after an incident—making it especially relevant for privileged account actions, customer data access, financial transactions, automated decisions, and evidence collection in legal disputes.

Deployment, Management, and Integration

The documentation shows HTTPS REST APIs, Bearer Token authentication, Idempotency-Key support, event queries, statistics, and Proof endpoints. The audit console supports monthly quotas, event types, time ranges, transaction ID filtering, and a Proof Explorer. For integration, Python, Node.js, Java, and Go already have framework middleware or SDK documentation, while Ruby, PHP, Rust, and C# are marked as “Soon.” Events can also be correlated with APM, Datadog, OpenTelemetry, and similar systems via trace_id. One caveat: although the materials describe a private ledger and state that events remain within the environment, they do not clearly define the boundaries between SaaS, self-hosted, or private deployment models.

Pricing and Compliance

Pricing is not public. What can be confirmed is that ImmutableLog supports a 7-day PoC, the free plan retains data for 7 days, paid plans retain data according to contract terms, and monthly event quotas apply; exceeding the quota returns a 429 response. On compliance, it references requirements around SOC 2, ISO 27001, LGPD, EU AI Act, NIST AI RMF, ISO 42001, BACEN, and other frameworks. However, it does not disclose which certifications the company itself has obtained. It should therefore be viewed as “compliance evidence infrastructure,” not as a certified compliance hosting service.

Pros, Cons, and Best-Fit Users

Its strengths are a sharp product focus, a clear evidence-chain design, and no reliance on public blockchains or tokens. It can also complement observability tools such as Splunk, Datadog, and Grafana. Weaknesses include the lack of information on pricing, SLA, support tiers, data residency, China network access, and payment methods. The roughly 16KB per-event limit also means enterprises need to design their own external storage strategy. ImmutableLog is better suited for CISOs, legal teams, audit teams, fintech, healthcare, insurance, government, and organizations that need traceability for AI-driven decisions.

Access from China and Alternatives

Direct access from mainland China, payment support, and local compliance status are unknown. If data export, MLPS, or local audit requirements apply, network and legal assessments should be completed first. Possible comparisons include Alibaba Cloud SLS, Tencent Cloud CLS, Huawei Cloud LTS, and local security audit products that support WORM retention. However, these products are usually more focused on log management, and whether they provide third-party-verifiable cryptographic proof needs to be checked case by case.